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We investigate quantum secret sharing schemes constructed from [[n, fc,<5]]o non-binary stabilizer 
quantum error correcting codes with carrier qudits of prime dimension D. We provide a systematic 
way of determining the access structure, which completely determines the forbidden and intermediate 
structures. We then show that the information available to the intermediate structure can be fully 
described and quantified by what we call the information group, a subgroup of the Pauli group 
of k qudits, and employ this group structure to construct a method for hiding the information 
from the intermediate structure via twirling of the information group and sharing of classical bits 
between the dealer and the players. Our scheme allows the transformation of a ramp (intermediate) 
quantum secret sharing scheme into a semi-quantum perfect secret sharing scheme with the same 
access structure as the ramp one but without any intermediate subsets, and is optimal in the amount 
of classical bits the dealer has to distribute. 
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I. INTRODUCTION 

Classical secret sharing, introduced first by [T] and [5] , 
is an important multipartite cryptographic protocol in 
which a dealer distributes a secret to a set of partici- 
pants (players) in such a way that only certain subsets of 
players that form the access structure can collaboratively 
recover it. Quantum secret sharing [3 5 is the natural 
extension of the classical protocol to the quantum do- 
main: the secret is now a quantum state, the players 
comprise of quantum systems and quantum communica- 
tion is allowed between the dealer and the players. The 
(q, n) threshold quantum secret sharing scheme is one of 
the most common protocols, in which the access structure 
comprises all subsets of q or more out of n players, and 
the forbidden structure consists of all subsets of less than 
q players. Recently the threshold quantum schemes have 
been extended to intermediate, or ramp schemes [6], in 
which there are subsets of players that may recover par- 
tial information about the secret and which collectively 
form the intermediate structure. Ramp schemes trade se- 
curity for efficiency: they allow the sharing of quantum 
secrets of a dimension larger than the dimension of the 
players' shares, which, as we explain later, is impossible 
in threshold schemes. 

An important desideratum in the theory of quantum 
(as well as classical) secret sharing is the construction 
of good protocols, and a vast amount of work is dedi- 
cated to this subject [7HTT]. A promising approach is the 
using quantum error correcting codes for the construc- 
tion of quantum secret sharing protocols: recovering a 
quantum secret is equivalent to the ability to detect and 
correct errors. One of the simplest examples of such du- 
ality between error correcting codes and secret sharing is 
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the [[5, 1,3]]2 qubit code that induces a (3,5) threshold 
quantum secret sharing scheme [5]. 

Given some quantum error correcting code, a funda- 
mental problem is to determine the induced access, for- 
bidden and intermediate structures, and to quantify the 
information available in intermediate subsets. The vast 
majority of literature approaches this problem from a 
state point of view: consider an arbitrary quantum state 
\ip) on the input state, then investigate the reduced den- 
sity matrix of the encoded state down to some subset S 
of the carriers. If the reduced density matrix is indepen- 
dent of the input state, then S belongs to the forbidden 
structure, whereas if the density matrix is isometrically 
equivalent to \ip)(ip\ then S belongs to the access struc- 
ture. The intermediate structure consists of subsets that 
do not satisfy the previous two conditions. 

Although the above approach works, it is in general 
tedious. Since the input state (secret) consists of k qu- 
dits, the number of coefficients used to describe it scale 
exponentially with k, and even numerical methods be- 
come inefficient for quantum codes with large k. In our 
present work, we employ a completely different approach 
based on a channel point of view, and regard the error 
correcting code as an isometric encoding of k qudits into 
n carriers, as shown schematically in Fig. [T] If the chan- 
nel from the input of the isometry to some subset S of 
carriers is perfect (up to a unitary or isometry) then S 
belongs to the access structure, and if it is totally noisy 
then S belongs to the forbidden structure, with the inter- 
mediate case in between. For the class of qudit stabilizer 
codes, which include the vast majority of known error 
correcting codes, we showed [12) that any such channel 
can be fully characterized by what we called an informa- 
tion group, a subgroup of the Pauli group of k qudits. 
The symplectic structure of the information group fully 
characterizes the capacity of the channel and it can be 
shown that the latter can perfectly transmit an integer 
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FIG. 1. Quantum secret sharing scheme induced by a stabi- 
lizer code, where V denotes the encoding isometry. 



number of r qudits plus an additional integer number s 
of classical "dits" , with r + s ^ k. This allows us to pre- 
cisely quantify the amount of accessible information by 
an intermediate set. Furthermore, determining whether 
the channel is perfect or not is a polynomial time (in k) 
decision problem, and this allows us to determine if S 
belongs the access structure efficiently. Having the ac- 
cess structure determined, we show that the forbidden 
and intermediate structures are fully determined by the 
former. 

We next show how to improve the security of general- 
ized secret sharing schemes and transform them to per- 
fect semi-quantum schemes, i.e. how to effectively "re- 
move" the intermediate structure while keeping the ac- 
cess structure the same. Our method is based on twirling 
what we call the intermediate information group, a sub- 
group of the Pauli group of k qudits associated with the 
intermediate structure. The symplectic structure of this 
group provides a systematic method of erasing the inter- 
mediate structure by allowing the dealer to send classical 
information to the players using an appropriate classical 
secret sharing scheme. We show that our scheme is op- 
timal in the amount of classical bits the dealer has to 
distribute. 

The remainder of this article is organized as follows. In 
Sec. [TT] we define the generalized Pauli group and qudit 
stabilizer codes. We then show in Sec. |III| how any ar- 
bitrary stabilizer quantum error correcting code induces 
a generalized secret sharing scheme, and prove that the 
access structure of the latter fully determines the forbid- 
den and intermediate structures. In Sec. lIVI we introduce 
the subset information group, show that it fully charac- 
terizes the amount of information accessible by a sub- 
set, then present an algorithm for determining the access 
structure. The method of transforming an arbitrary gen- 
eralized secret sharing scheme into a perfect scheme by 
allowing the sharing of extra classical bits between the 
dealer and the players is the subject of Sec. |Vj Finally, 
we present simple illustrative examples in Sec. |VI| and 



II. PRELIMINARY REMARKS AND 
DEFINITIONS 

A. Generalized Pauli operators and graph codes 

We generalize Pauli operators to higher dimensional 
systems of prime dimension D following [T3TU5| . The X 
and Z operators acting on a single qudit arc defined as 
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and satisfy 



X D = Z D = I, 



XZ = ujZX, 
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where the addition of integers is modulo D, as will be 
assumed from now on. For a collection of n qudit^Jwe use 
subscripts to identify the corresponding Pauli operators: 
thus Zi and X{ operate on the space of qudit i. The 
Hilbert space of a single qudit is denoted by H, and the 
Hilbcrt space of n qudits by T-L n , respectively. Operators 
of the form 



u x X*Z* 
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will be referred to as Pauli products, where A is an integer 
in Zrj and x and z are n-tuples in Z D , the additive group 
of n-tuple integers mod D. For a fixed n the collection 
of all possible Pauli products Q form a group under 
operator multiplication, the Pauli group V n - If p is a 
Pauli product, then p D = I is the identity operator on 
Tin, and hence the order of any element of V n is D. While 
V n is not Abelian, it has the property that two elements 
commute up to a phase 

pip 2 = 0J Xl2 p 2 pi, (4) 

with A12 an integer in that depends on pi and p 2 - 

The collection of Pauli products with A = 0, i.e. a 
pre-factor of 1, is denoted by Q n . The elements X X Z Z 
of Q n form an orthonormal basis of £(W n ), the Hilbert 
space of linear operators on T-L n , with respect to the inner 
product 

1 Tr[(X^)tx^] = 5suS2 5 SlA , 



D r < 



vx Xl z Zl ,x X2 z Z2 e Q r , 



(5) 



Note that Q n is a projective group or group up to phases. 
There is a bijective map between Q n and the quotient 
group V n /{ui x I} for A S Zpj where {ui x I}, the center of 
V n , consists of phases multiplying the identity operator 
on n qudits. The projective group Q n is also isomor- 
phic to the additive group of 2n-tuple integers under 
addition mod D. 



1 or k, depending on the context; for the latter case one should 
replace n by k in all definitions of this subsection. 



3 



B. Qudit stabilizer codes 

Relative to the Pauli group V n of n carrier qudits we 
define a stabilizer code He to be a if > f-dimensional 
subspace of the carriers' Hilbert space H n , He C H n , 
satisfying three conditions: 

CI: There is a subgroup S of V n such that for every s 
in S and every \ip) in C 

»W) = Wi (6) 

C2: The subgroup S is maximal in the sense that every 
s in V n for which ^ is satisfied for all \ip) £ "He* 
belongs to 5. 

C3: The coding space He is maximal in the sense that 
any ket that satisfies ([6| for every s £ S lies in 

If these conditions are fulfilled we call S the stabilizer 
of the code He- That it is Abelian follows from the 
commutation relation Q, since for K > there is some 
nonzero \ip) satisfying |6]). 

Note that one can always find a subgroup S of V n 
satisfying CI and C2 for any subspace He of the Hilbert 
space, but it might consist of nothing but the identity. 
Thus it is condition C3 that distinguishes stabilizer codes 
from nonadditivc codes. A stabilizer code is uniquely 
determined by S as well as by He, since S determines 
He through C3, so in a sense the code and its stabilizer 
are dual to each other. 

A qudit stabilizer code is usually denoted by [[n, k, 8]]d 
where n represents the number of carrier qudits (each of 
dimension D, assumed in this article a prime number) 
and k specifies the number of input (or encoded) qudits, 
assumed to have the same dimensionality D as the car- 
rier qudita^J Here 6 is the distance of the code [T7], a 
parameter that essentially specifies how "good" the code 
is: best codes have as large as possible distance with as 
few as possible carriers. The stabilizer code can then be 
seen as arising from the isometric encoding of the input 
space Hk into the K = D k dimensional subspace He of 
H n by the isometry 

K-l 

V:H k ^H c cH n , V=Y / \ c j)U\- ( 7 ) 

3=0 

Here {\j}} is an orthonormal basis of the input space Hk 
and the coding space is specified by He = Span{|cy)}, 
where the codewords |cj)'s are all orthogonal. Note that 
V cannot be any isometric encoding of Hk into He, but 
one compatible with the stabilizer requirements C1-C3 
above. 



2 See |16| for a general treatment of stabilizer codes with qudits 
of composite dimensionality, where some differences arise. For 
example, the input qudits do not have to have the same dimen- 
sionality D as the carriers, but can be of any dimension d that 
divides D. 



III. GENERALIZED SECRET SHARING 
SCHEMES 

A. Access, forbidden and intermediate structures 

We now show that any quantum error correcting code 
can be turned into a generalized secret sharing scheme as 
follows. Let \ip) G Hk be an arbitrary k qudit quantum 
state, (secret, unknown by the n output qudits), which 
is then "distributed" to the n carrier qudits (players) via 
the corresponding stabilizer encoding V , so the n players 
end up sharing the encoded state V\ip) £ He C H n . Let 
N = {1,2, ... ,n} denote the set of output qudits, and 
let JV be the collection of all subsets of N, i.e. the power 
set of N. We define the following structures: 

• A — the access structure (or the authorized struc- 
ture): A C J\f such that any subset of qudits S £ A 
can fully recover \ip) , i.e. the quantum channel from 
the input of the isometry V to any subset in S G A 
is perfect. 

• J- - the forbidden structure (or the un- authorized 
structure): J- C Af such that no subset of qudits 
S G T can recover anything about i.e. the 
quantum channel from the input of the isometry V 
to any subset in S G J- is completely noisy. 

• I - the intermediate structure (or the ramp struc- 
ture): I C N such that any subset of qudits S G I 
can recover some partial information about i.e. 
the quantum channel from the input of the isome- 
try V to any subset in S G A is noisy (not perfect 
nor completely noisy). 

In conclusion, the isometry V completely determines the 
triplet (A, J 7 ,!), and we call the latter a generalized se- 
cret sharing scheme. Whenever X = {0} we call the 
scheme perfect. Our definition generalizes the two most 
common secret sharing schemes in the literature: 

1. the threshold (q,n) secret sharing scheme, in which 
any subset of q or more players can fully recover 
the quantum secret (are authorized), whereas any 
subset of less than q players cannot recover any 
information whatsoever about the secret (are for- 
bidden). Formally, 

A = {S G N : \S\ > q} , 
T = {S G N : \S\ < q} , 
^={0}, (8) 

where \S\ denotes the size of the set S, i.e. the 
number of players in S. The threshold schemes 
are a strict subset of the perfect schemes, since the 
latter allow for access structures with subsets of 
different sizes; 

2. the ramp {q, L, n) secret sharing scheme, in which 
any subset of q or more players is authorized, any 
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subset of q — L or fewer is forbidden, and those 
with q — u(0 < u < L) are not all authorized nor 
all forbidden. In this notation a threshold secret 
sharing scheme has L = 1. In our notation, a ramp 
(q, L, n) scheme must have 



A? {Se N 
F^{SeN 
ic {Se N 



\S\>q}, 

\S\^q-L}, 

q-L<\S\<q}. 



(9) 



Note that any [[n, k, 5]]d stabilizer code can be turned 
into a (q, L, n) ramp secret sharing scheme, with q = 
n — S + 1 and L = n — 26 + 2, since any subset of more 
than n — S players has full information about the secret 
and can fully recover the secret by a suitable decoding 
procedure, hence it is an authorized set and belongs to 
the access structure, whereas any subset of less than 6 
players has no information whatsoever about the secret, 
hence it is a forbidden set and belongs to the adversary 
structure; see Sec. III. A of |T5] for a simple no-cloning 
based argument. One therefore has a ramp (n — 5 + 
1, n — 26 + 2, n) quantum secret sharing scheme. 

We now illustrate the concepts of this section by simple 
examples. First, consider the [[5, 1,3]]2 code [15] [20]. It 
can be shown that all subsets of size 3 or more can fully 
recover whatever information was encoded, whereas any 
subset of size 2 or less cannot recover anything. Therefore 
this code can be turned into a (q = 3, n = 5) threshold 
secret sharing scheme. 

Next, consider the [[7, 1,3]]2 additive graph code of 
|12j . which is locally unitarily equivalent to the Steane 
code [3T]. It then follows that all subsets of size 5 or 
more can recover what was encoded, whereas any subset 
of size 2 or less cannot recover anything. However, there 
is more to say about this code, and one can show that the 
subsets of size 3 or 4 can either fully recover the secret or 
cannot recover anything, hence X — {0}, so the scheme is 
perfect (although not threshold). See the discussion on 
pg. 10 of [T3] for a detailed discussion and for a full list 
of subsets comprising A and T . 

Finally, consider the [[4, 2,2]] 2 code [33] that can cor- 
rect one erasure error, i.e. can fully correct one qubit 
error provided one knows what the corrupted qubit is. It 
can be shown [T5] that all subsets of size 3 or 4 can re- 
cover all encoded information, whereas any subset of size 
1 cannot recover anything. All subsets of size 2 can only 
recover partial information (are not able to fully recon- 
struct what was encoded). We can therefore turn this 
code into a(g = 3,L = 2,n = 4) ramp secret sharing 
scheme. Using our formalism, A = {S G Af : \S\ ^ 3}, 
T = {S G N : \S\ sC 1} and 1 = {S G N : \S\ = 2}. 



in the theory of quantum secret sharing, and, before pro- 
viding a full answer to this question, we first explain why 
the access structure A completely determines the forbid- 
den structure J 7 (and viceversa), and together they de- 
termine the intermediate structure X, so it is enough to 
know only A (or J 7 ) to determine the full triplet (A, F, X) . 
The fact that A is dual to JF was already known [U [S] , 
but we restate the result for the sake of completeness. 

Theorem 1. Let (A,J-,I) be a generalized quantum se- 
cret sharing scheme induced by some quantum error cor- 
recting code. Then A and J- are dual to each other, and 
completely determine I, in the sense 

A = {S eAf : S eJ} , (10) 
T= {SeM: S<EA} : (11) 
2 = M\{A\jT}, (12) 

where S — N \ S denotes the complement of S . 

Proof. The argument is based on two facts: i) a perfect 
quantum channel cannot "leak" information, since other- 
wise the no-cloning theorem is violated; and ii), an isom- 
etry "conserves" information: if it is absent from some 
part of its output it has to be present in the complement. 

Consider first a subset S G A. Then the players in 
S can recover full information about what was encoded, 
and, by the "No Splitting" Theorem of [23], this implies 
that the complement S cannot contain any information 
whatsoever about the input, hence must belong to the 
forbidden structure J- . Intuitively, if 5* belong to the ac- 
cess structure, then the quantum channel from the input 
of the underlying isometry V to S (obtained by partially- 
tracing down S) must be perfect, so the complementary 
channel to S must be completely noisy (otherwise the 
no-cloning theorem will be violated), which is the same 
as saying that Se J. 

On the other hand, let's now consider a subset S G T. 
Then, absolutely no information about what was encoded 
can be recovered from S, and, by the "Somewhere The- 
orem" of |23j . all information about the input must be 
present in S, hence S G A. Intuitively, this is the same 
as saying that an isometry "conserves" information: if it 
is absent from a subset it must be present in its comple- 
ment. This proves the duality (10)-(11| between A and 

□ 



Finally, (12 1 follows at once by construction. 



We therefore conclude this section by restating that it 
is enough to determine A (or J 7 ) in order to fully deter- 
mine (A, J 7 , 1) . In the next section we provide a system- 
atic way of determining A. 



B. Relations between A, J- and X 

The following question arrises naturally: given an arbi- 
trary stabilizer code, how can one determine the induced 
triplet (A, J 7 , 1)? This question is of crucial importance 



IV. DETERMINING (A,T,1) 

We now review some essential results about informa- 
tion location in subsets of players of a quantum secret 
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sharing scheme induced by an [[n, k, 6]]d stabilizer code. 
The interested reader can consult our previous work |12j 
for detailed proofs of the claims of this section^] 



A. The subset information group and the access 
structure 

Let us consider a subset S € Af of players, and let S de- 
note its complement. The relevant question for quantum 
secret sharing is how much information can S recover 
about a previously encoded secret G "Hfc? Whatever 
information S can extract about the secret is fully deter- 
mined by the reduced density matrix 



Ps 



(13) 



Since the collection Qk of Pauli operators on the input 
space Hk forms an operator basis of the dealer's operator 
Hilbert space £(Hk), one can expand the secret as 



(14) 



where 



c(x,z) = Tr [(A*Z*)t|^|] = (^|(X^)t|V>) (15) 

are the Fourier coefficients of the expansion. 
The state of S is then 

Ps = E c(x,z)Tt § [VX s Z^}. (16) 

We shown in [12] that the collection of operators X X Z Z 
on the dealer's space U k for which Trj [VX S Z Z V*] ^ 
forms a group G(S), called the subset information group. 
We have also proved that the subset information group 
fully characterizes what kind of correlations are present 
between the dealer and the subset S of the players, 
and provided an efficient linear algebra based algorithm 
for finding it. More specifically, if X x Z z g G(S), i.e. 
Trg [VX X Z Z V^] ^ 0, then any two eigenvectors \(f>i) and 
\<p2) of X X Z Z remain fully distinguishable on the subset 
S after the encoding by V, i.e. have orthogonal support 
so their Hilbert-Schmidt inner product is zero 



Tr 



(KslVl^ifalV^TrslVlfoHfolVi]] = 0. (17) 



In other words, if X X Z Z £ G(S), the correlations between 
the players in S and the dealer are perfect in the eigen- 
basis of X X Z Z , that is, if the dealer chooses the secret to 



3 All results in were proven for additive graph codes (a subset of 
stabilizer codes, see e.g. 1241 for a comprehensive introduction), 
but we noted that all our results are automatically valid for prime 
dimensional stabilizer codes, since the latter are locally unitary 
equivalent to the former, as proved by Schlingemann in 1251 . 



be one of the the eigenvectors of X X Z Z , say \<fij), then 
the players in S can fully recover the j by performing an 
appropriate positive operator- valued measure (POVM). 
We say that the X X Z Z type of information [53] is per- 
fectly present in S. We also proved that the C*-algebra 
generated by the elements of G{S) is fully correctable [2BT 
|2"8] on S, that is, any 2 orthogonal states in the algebra 
remain orthogonal after encoding and tracing down to S. 

The subset S contains no information whatsoever 
about the secret \4')('4'\ if an d only if the subset informa- 
tion group is proportional to identity on Hk, G(S) oc /, 
or, equivalently, all encoded operators VX x Z z V j; trace to 
zero down to S with the exception of VX 5 Z®V^ = VV^ . 
That is, no matter what measurement strategy the play- 
ers in S adopt, they cannot recover any information 
about the secret \ip)(tp\, or, equivalently, the reduced den- 
sity matrix p$ is independent of I^X^I, 

1 



(18) 



The subset S contains all information about the secret 
if and only if the subset information group is the whole 
Pauli group Vk, G(S) = Vk, hence we have the following 
Theorem. 

Theorem 2. Let (A,J-,I) be a generalized quantum se- 
cret sharing scheme induced by an [[n, k, 5]}d quantum 
error correcting code. Then the access structure A is 
given by 

A = {S eAf :G(S)=V k }. (19) 
Proof. See Theorem 4 (iii) of [T^j for a rigorous proof. □ 

To determine whether G(S) — Vk for some subset S 
reduces to checking whether the partial trace down to S 
of the 2k encoded generators of Vk is not zero. This is 
because if some encoded generator traces down to zero 
on S, then, by the group property, G(S) must be a strict 
subset of Vk (removing an independent generator makes 
the generated group strictly smaller). The question "Is 
G(S) = Vk 1 ." is a decision problem, and its yes/no answer 
can be provided via solving a system of linear equations 
over Zrj, see Appendix C of [12] for a detailed efficient 
algorithm (with polynomial running time in n and fc). 

Note that one can also use the Choi-Jamiolkowski iso- 
morphism in determining if a subset S belongs to the 
access structure as follows. Consider a maximally entan- 
gled state \^ + ) between the input of the isometry and 
some reference system R. Let 



and let 



= (7 fl ®V)|*+) 



p R s = Tr § \(l)(n\. 



(20) 



(21) 



Then S € A if and only if p^g is a pure maximally entan- 
gled state, since the latter implies that the channel from 
the input of V to S is perfect. However, our approach 
is more powerful since it characterizes the information 
present in intermediate subsets, as described in the next 
subsection. 
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B. The structure of the subset information group 
and the information available in an intermediate 
subset 

Let <7i, <72> • • • j 9m be a minimal generating selQof G{S), 

g(S) = ( gi ,g 2 ,...,g m ). (22) 

Since G(S) is a subgroup of the Pauli group of k qudits 
each of prime dimension, it is Clifford equivalent to a 
simpler group Go(S), the canonical subset information 
group, generated only by "local" X and Z operators, 

g (S) = wg(s)w* 

= (X\, Zi, . . . , X r , Z r , Z r+ i, . . . , Z r+S ) (23) 
= Qo Vm (S) \jGo°(S), with 2r + s < 2k, (24) 

where W is a Clifford operatoi[^]that depends on the sub- 
set S, but for simplicity of notation we remove this de- 
pendence. Here 



G s vm (s) = (x 1 ,z 1 ,...,x r ,z r ) 

is the symplectic subgroup of Go(S) and 



Gq 



(S) 



r+sl 



(25) 



(26) 



is the isotropic subgroup of Gq{S). 

The fact that 0(S) is isomorphic to Go(S) in (23) is a 
direct consequence of a more general result regarding the 
structure of bilinear symplectic forms, see Theorem 1.1 
of [29]. Sec. IV. B of [30] provides an explicit algorithm 
for constructing the Clifford operator If as a product 
of elementary qudit Clifford gates; the qudit algorithm 
is just a straightforward generalization of the qubit one 
presented in Sec. 1 of [31]. 

The form of Go(S) combined with the remarks of the 
previous subsection that the C* -algebra generated by 
Go(S) is fully correctable allows us to say that the quan- 
tum channel from the input of the isometry to the subset 
S, obtained by partially-tracing over S, is a perfect r- 
qudit channel (corresponds to the symplectic subgroup 
Go Vm {S)) tensored with a perfect s dit classical channel 
(corresponds to the isotropic subgroup Gq so (S) and its 
quantum capacity is zero, since its correctable algebra 
is commutative). In other words, the channel can per- 
fectly transmit r qudits plus extra s classical dits, which 
is equivalent, in the context of secret sharing, to the fact 
that the players in S can fully recover r qudits of the 
secret together with at most s "extra" classical dits of 
information by performing an appropriate decoding pro- 
cedure. 



4 That is, removing any generator results in generating a strictly 
smaller group. 

5 A Clifford operator in a unitary operator that maps Pauli oper- 
ators to Pauli operators through conjugation, that is, leaves the 
Pauli group invariant under conjugation. 



CONCEALING THE INTERMEDIATE 
STRUCTURE VIA TWIRLING 



Consider now a generalized secret sharing scheme in 
which there are no intermediate structures, i.e. I = {0}. 
In this case it can be shown [3] that the dimension of 
the quantum secret cannot exceed the dimension of each 
individual player's quantum system, or, equivalently, 
that [[n, k, 5]]n codes induce generalized secret sharing 
schemes that must have I ^ {0} whenever k > 1. The 
argument is based on the fact that there exist forbidden 
subsets that can be made authorized by the addition of 
only one additional player, hence complete information 
about the secret is transferred via a single player's quan- 
tum system, from which the bound follows. Therefore, 
threshold quantum secret sharing schemes are extremely 
inefficient in terms of the required quantum communica- 
tion. For example, if the dealer wants to share a 1,000 
qubit secret to 1,000 players, then each player has to 
posses at least a 1, 000 qubit quantum system, for a total 
of 1, 000 x 1, 000 = 1, 000, 000 carrier qudits! 

However, ramp schemes do not have this strong lim- 
itation: security is traded for efficiency, so that play- 
ers belonging to the intermediate structure can extract 
some partial information about the secret, with the ben- 
efit that the encoded quantum secret can have larger di- 
mension than the players' individual share size. 

Are there ways to improve the security of such inter- 
mediate secret sharing schemes, for example, by reduc- 
ing the amount of information the intermediate struc- 
ture can extract about the quantum secret? As recently 
shown in fTT] such methods exist and are based on com- 
bining the ramp quantum secret sharing scheme with a 
classical secret sharing scheme. In the simplest scenar- 
ion, the dealer prepares a fc-qudit secret, then for every 
input qudit i chooses with equal probability 1/D two in- 
tegers mi,ni G Zrj, then applies the operator X™'^"'; 
the dealer effectively encrypts the quantum secret using 
a 2k classical key, then distributes the "scrambled" se- 
cret to the players using the stabilizer encoding. From 
the players point of view, who do not know the integers 
m, and n*, this is equivalent to the application by the 
dealer of a completely depolarizing, or "twirling" , chan- 
nel to each input qudit. After this the dealer distributes 
the 2k dit classical key to the n players using a classical 
threshold secret sharing scheme (q,n), with q appropri- 
ately chosen, so that any subset of q or more players can 
recover the classical key, which allows them to "undo" the 
effect of the depolarizing channel and recover the whole 
quantum secret, whereas any subset of less than q play- 
ers has no information whatsoever about the classical key 
and their shared quantum state is independent of the se- 
cret. In this way, a generalized secret sharing scheme 
induced by an [[n, k, 5]}d stabilizer code is transformed 
to a threshold secret sharing scheme (q, n). This method 
is very similar to teleportation, in which Bob cannot re- 
cover Alice's state without knowing the results of Alice's 
measurements (that play the role of the twirling channel) . 
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This motivates the following question: given the in- 
termediate structure X, what is the most efficient way 
of "erasing" the information from it, i.e. what is the 
minimum length of the classical random encryption key 
the dealer must use and how can this be done system- 
atically, for arbitrary generalized secret sharing schemes 
(induced by stabilizer quantum error correcting codes)? 
We present below such a systematic method and show 
that the dealer can in general use classical encryption 
keys of smaller length I, with k ^ I ^ 2k, and that the 
length of the encryption key depends solely on the un- 
derlying stabilizer code. We will further show that our 
scheme is optimal in the length of the encryption key, 
that is, one cannot use shorter keys. This minimizes the 
amount of classical communication between the dealer 
and the players. 



A. Hiding information from a subset 

The whole idea behind our scheme is to employ the 
structure of the subset information group Go(S). Con- 
sider a generator of Go(S). Without loss of generality, we 
choose X\. Then, as mentioned before, the players in S 
can recover the Xi-type of information about the secret 
by an appropriate POVM. Suppose now that before the 
encoding the dealer applies with probability pj = l/D 
the operator Z\, where < j < D. One can easily check 
that 



D-l 



3=0 



1 ^ 

3=0 



= 0. 



(27) 



Then, the Xi-type of information is hidden from the sub- 
set S, since, effectively, the players in S do not know 
which j the dealer chose, and, by (27), the terms of the 

VXiV^ in the expansion (16) of ps become 



form Trg 
now 



D-l 



V 



D 



j2 zixizv v 



3=0 



0. 



(28) 



where V — VW (we remind the reader that Go(S) was 
obtained from G(S) via a conjugation by the Clifford op- 
erator W and this is why V is replaced by V in (p8|). 
Also, any other operator in the information group that 
contains X\ gets mapped to zero (a direct consequence of 
(27 1), so at the end all non-zero terms in the expansion 



of that contain the X\ generator become zero. 

It is now clear how the dealer can hide all informa- 
tion about the secret from the players in S: twirls each 
generator of the canonical subset information group by a 
corresponding non-commuting operator (either X or Z). 
Since any operator in the information group is a prod- 
uct of the generators, it follows at once that it will get 
mapped to zero by the twirling procedure, with the ex- 
ception of the identity. Therefore, if before twirling the 



quantum secret was represented in S by a state of the 
form (161, after the twirling procedure the state down 
to S has the form (18), i.e. the players in S lack any 



information whatsoever about the secret. 

Note that if the players know which operators the 
dealer applied to perform the twirling, they can recover 
the same information about the secret as before the 
twirling, since the twirling unitary on the dealer's space 
is effectively just a change of basis now known by the 
players. 



B. Perfect semi-quantum secret sharing schemes 

Consider now the collection of intermediate subsets X. 
To hide the information from X we can define the "in- 
termediate information group" or the "ramp information 
group" as a union of all intermediate subset information 
groups 



G(X) := |J G(S), 



(29) 



sex 



which again is a subgroup of the Pauli group Vk- Next 
employ the same arguments as in the previous subsection, 
but now with G(X) replacing G(S) (and Go(X) denoting 
the canonical intermediate information group obtained 
from G(S) through an appropriate Clifford conjugation). 
The dealer distributes the randomly generated classical 
key to the players using a perfect classical secret shar- 
ing scheme (A' , J 7 ' ,X'), having A' = A, J 7 ' = J 7 |J X and 
X' = {0}, so that the players in I have no information 
whatsoever about the key but players in A can fully re- 
cover the key. In this way, the information is concealed 
from I. Note that classical secret sharing schemes with 
arbitrary access structure exist [32] as long as the access 
structure is monotone -i.e., if a set S can recover the 
secret, so can all sets containing S. In conclusion, us- 
ing our scheme one can transform an arbitrary (A, J 7 , X) 
ramp scheme into a perfect scheme (A, -FIJI, {0}) with 
the same access structure but without any intermediate 
subsets! See Fig. [2] for a graphical description of our 
protocol. 

In particular, if we define q to be the minimum inte- 
ger so that all subsets of players of size q or more be- 
long to A (and therefore the subsets in X must be of 
smaller size), then we can employ a classical (q, n) thresh- 
old secret sharing scheme to distribute the classical key 
to the n players so that all subsets in A of size q or more 
can fully recover the key, hence the full quantum secret, 
whereas the players in X have no information whatso- 
ever about the classical key and cannot recover anything 
about the original quantum secret. In this way, a gener- 
alized (A, J 7 ,X) quantum secret sharing scheme induced 
by an [[n, k, 6]}d stabilizer quantum error correcting code 
can be turned into a threshold (q = n — 5 + 1, n) semi- 
quantum secret sharing scheme by allowing the sharing 
of 2r + s ^ 2k classical bits between the dealer and the 
players. 



Distribute the 2r+s dit-length classical encoding key 
using a perfect classical secret sharing scheme 



CD 
&_ 
O 
CD 
W 
-t— i 

Q_ 



|v> 



Twirlingj Canonical 

i form 
1 



Stabilizer 




g (i) = (x 1 ,z 1 



FIG. 2. Turning a ramp quantum secret sharing scheme into 
a perfect semi-quantum secret sharing scheme. Note that r + 
s = k, as shown by Lemma [l] 



The twirling followed by the encoding of the classi- 
cal key into a perfect classical secret sharing scheme can 
be seen as effectively "cutting" the ramp structure and 
transforming it to an un-authorized structure. Mathe- 
matically, the intermediate information group Gq(X) is 
being "twirled" to the identity operator, i.e. 



Y^UgU^O, Vgeg (l),g^I, 



(30) 



u 



where the sum is taken over all unitary operators U of 
the form X^Z^Z^p, 1 < i sC r, 1 < j < s and 
mi,rii,m r +j run over all possible integers in Zp, so the 
number of terms in ( 30 ) is 



D r x D r x D s 



D 



2r+s 



d 



2k 



Compactly we write 



(31) 



(32) 



case whenever the information group Q{X) is Abelian, 
which means that before the twirling the intermediate 
subsets were able to extract only classical information 
about the secret. Our result is summarized by the fol- 
lowing Lemma. 

G(Z) be the intermediate in- 
obtained from an [[n, k,6]]r) 



Lemma 1. Let 

formation group 
stabilizer quantum 

g (i) = (x l ,z 1 ,... 



error 
X r , Z r , 



correcting code. 



Z 



r+li ■ 



z„ 



r+sl 



be 



Let 
the 



canonical intermediate information group isomorphic to 
Q (I) . Then 

r + s = k. (34) 

Proof. We prove the Lemma by contradiction. Assume 
r + s < k. Split the input qudits into 2 subsets, I\ and 
7 2 , with L\ consisting of the first r + s qudits and with 
L2 consisting of the last k — (r + s) qudits. Choose R to 
be some subset that belongs to the ramp structure. 

We first show that the complement R of R must also 
belong to the ramp structure. There are 3 possible cases 
for R to belong to : i) the un-authorized structure; ii) the 
access structure; iii) the ramp structure;. Case i) must 
be excluded, since it implies (see the "Somewhere Theo- 
rem" of [53]) that the complement R of R must belong 
to the access structure, which contradicts the hypothesis 
that R belongs to the ramp structure. Also case ii) must 
be excluded, since it implies (see the "No Splitting The- 
orem" of [53]) that the complement R of R must belong 
to the un-authorized structure, which again contradicts 
the hypothesis that R belongs to the ramp structure. We 
therefore conclude that case iii) is the only possible one, 
i.e. R must belong to the ramp structure. 

Let us return now to the collection I2 ■ The structure of 
Go(I) implies that no information about Li is present in 
any subset that belongs to the ramp structure. Denote 
by R such a subset. Then, by the "Somewhere Theo- 
rem" of [33], all information about 1% must be present in 
the complement R of R. But we just proved above that 
the complement of R must belong to the ramp structure, 
hence R can extract partial information about L2, a con- 
tradiction. Hence the initial hypothesis r + s < k must 
be false. But r + s cannot be greater than k, therefore 
r + s = k. □ 



We call the collection of all D 2r D s such unitary oper- 
ators the twirling group (it is easy to see that the col- 
lection of such operators form a group), and denote it 
by To(T). Note that the structure of the twirling group 
is easy to read from the structure of Oo(I), namely, if 
Go(2) = (Xi,Zi,...,X r ,Z r ,Z r+ i,...,Z r+s ), then the 
twirling group 7~o(T) is generated by 



7o(I) — (Xi, Zi, . . . , X r , Z r , X r . 



,X 



r+s/ 



(33) 



We can show that r + s = k, which implies that the 
length I = 2r + s of the classical encryption key is in 
general smaller than 2k, but is bounded below by k, the 
lower bound being achieved whenever r = 0. This is the 



VI. EXAMPLES 



A. The CNOT scheme 



The simplest example that illustrates our point is a 
quantum [[2, 1, 1]] 2 code arising from a CNOT-type isom- 
etry, illustrated Fig. [3] Although the code has distance 
1 and is not really useful for quantum error correction, 
it illustrates the basic principles of our work in a very 
simple and intuitive manner. The codewords are 



|cq) = CNOTQO) ® |0)) - [00) 
|ci) = CNOTQl) ® |0)) = |11>. 



(35) 
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Input 




Sc$g (s) = g(s) = {z) 



s^g (s) = g(S) = (z) 



FIG. 3. A CNOT-based encoding 



It is clear that if both S and S come together they can 
reconstruct any secret that was encoded by the dealer 
(they simply "undo" the effect of CNOT by applying 
it again). However, any individual player (consider just 
S, since by symmetry the situation is similar for S) has 
some partial information about the secret. The subset 
information group in this case is generated by 



g (s) = g (s) = g(s) = g(s) = (z), 



(36) 



so the player 5* (or S) can only extract ^-information 
about the secret. This is easy to verify, since the eigen- 
vectors of the Z operator, |0) and |1), are encoded into 
1 00) and |11), respectively, and the individual players can 
distinguish with certainty whether |0) or |1) was fed in 
at the input. On the other hand, the X-type of informa- 
tion is totally absent from both S and S, and this can 
easily be seen by noting that |+) = (|0) + |1))/V2 and 
l — ) = (|0) — |l))/v2 are encoded into 2 Bell states which 
are locally indistinguishable. The Y-type of information 
is also locally absent, by the same argument. Therefore 
we have 



A={{1,2}}, 
1 ={{!}, {2}}. 



(37) 



To hide the partial information from the ramp struc- 
ture, the dealer randomly generates an integer m and 
then applies the operator X m before encoding (note that 
it is essential that X does not commute with the gener- 
ator Z of the information group ); the twirling group is 
generated by (X) . The dealer then distributes the bit m 
to the 2 players using a classical (2, 2) threshold secret 
sharing scheme, see Fig. [4] for a graphical description. 

No individual player can recover m (the classical key) , 
hence cannot recover any information about the secret. If 
the two players collaborate they can then recover m, undo 
the effect of the twirling, then fully recover the quan- 
tum secret. Therefore this code is turned into an opti- 
mal (2, 2) semi-quantum threshold secret sharing scheme. 
Note that the number of classical bits required is half 
compared to the scheme in which the input is fully depo- 
larized by a twirling group (X, Z) . The length of the clas- 
sical key is actually achieving the lower bound I = k = 1. 

This example is extremely simple but illustrates our 
main concepts, and the interested reader can easily work 
out the details. 



m=0 or 1 



Classical (2,2) threshold secret sharing 

with p=1/2 



Input -x 




FIG. 4. "Cutting" the ramp structure by twirling. 



Classical (n,n) threshold secret sharing 



Input — x 




FIG. 5. GHZ encoding. "Cutting" the ramp structure by 
twirling. 



B. The n-partite GHZ scheme 

We consider now a generalization of the CNOT en- 
coding. The underlying structure is a stabilizer code 
[[n, 1, 1]]2 with 2 codewords, 



|co) = |00 - - ■ 0) 



(38) 



and the encoding circuit can be realized as a "cascade" 
of CNOT gates, see Fig. [5] This code has still distance 
1, but nevertheless can correct for bit-flip errors using a 
majority- voting based decoding. The entire collection of 
n players can fully reconstruct the secret, whereas any 
subset of less than n players belongs to the ramp struc- 
ture and can only recover Z- information about the secret. 
More technically, 



go(S)=g(S) = (Z), VSwith|S|<n, 



(39) 
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hence 

A = {{l,...,n}}, (40) 

1 = {S eAf: \S\ <n}. 

The ramp structure can be "cut" by a twirling with X m 
on the input (so the twirling group is generated again 
by (X)), followed by the encoding of the bit m into an 
(n, n) classical threshold secret sharing scheme. There- 
fore we end up with an (n, n) semi-quantum threshold 
secret sharing scheme , with a classical encoding key of 
length I = k = 1 (the classical communication required 
is minimal and equal to the number k of input qubits). 



VII. CONCLUSION AND OPEN QUESTIONS 

We showed that an [[n, fc, 8]]d qudit stabilizer code in- 
duces a generalized secret sharing scheme consisting of 
3 structures: an access structure A of which subsets of 
players can fully recover the secret, a forbidden structure 
T of which subsets cannot recover any information about 
the secret, and an intermediate structure I of which sub- 
sets can only recover partial information about the se- 
cret. Using an approach based on the theory of qudit 
stabilizer codes we provided a systematic way of deter- 
mining the collections A, J- and X, We proved that the 
information available to a subset (or a collection of sub- 
sets) of players can be fully described by an information 
group, a subgroup of the Pauli group of k qudits, and 
this quantifies the amount of accessible information in 
the subset. The structure of the information group pro- 
vides a natural way of "scrambling" (or "twirling") the 
quantum secret: the dealer applies a unitary operator 
randomly chosen from the twirling group, completely de- 
termined by the information group. The twirling group 
is generated by k ^ 2r + s ^ 2k generators, hence the 
twirling operators are indexed by 2r + s integers in Z/j, 
for a total number of D 2r+S . The dealer can conceal the 
information from the ramp structure by distributing the 
2r + s-length key (that specifies which twirling operator 
he applied) to the set of n players using an appropri- 
ate perfect classical secret sharing scheme. In particular, 
we showed that any [[n, k,S]]D stabilizer code induces 
a semi-quantum (ri — 6 + l,n) threshold secret sharing 
scheme. Our scheme is optimal in terms of the length 
of the classical encoding key the dealer has to distribute 
to the players, in contrast to the obvious scheme of 2k- 
length key, in which the twirling group is the full Pauli 
group of k qudits. Our method allows in general for bet- 
ter perfect classical secret sharing scheme encodings of 
the classical key, and therefore may drastically reduce 
the total amount of classical communication. 

Our scheme is extremely flexible and allows for the 
construction of more general secret sharing schemes, not 
just perfect ones. For example, suppose we are inter- 



ested in hiding partial information only from a collection 
J C T of subsets of players, not necessarily the entire 
ramp structure. Then it is enough to find the group 
G(I), which is constructed as the union of all subset in- 
formation groups that correspond to the subsets in the 
collection, then apply the same algorithm as before, but 
now to G{J) instead of G(I)- We can therefore "cut" 
the information about the secret from any collection of 
subset of players we are interested in. 

Our formalism can also be applied in entanglement 
sharing schemes, in which the goal of the dealer is to 
distribute entanglement to subsets of players in such a 
way that any given subset is either fully entangled with 
the dealer or otherwise heir joint state is separable across 
the dealer/players cut. This is equivalent to the fact that 
for any subset, the corresponding information group must 
be either Abelian or the entire Pauli group Vk- If this is 
not the case, we can again employ the notion of twirling 
and classical secret sharing to transform the intermediate 
subset group to an Abelian one. 

A central issue we did not address in the current article 
is the recovery operation. In principle, since an autho- 
rized set has full information about the secret, a recov- 
ery channel always exists, but its construction may not 
be obvious. In this article we adopt the common strat- 
egy used in the search for good quantum error correcting 
codes 24J, in which one is not interested in the decod- 
ing but only in the parameters of the code. It would 
be nice to find a clean and systematic way of explicitly 
constructing this recovery operation. 

In the present article we made heavy use of the sta- 
bilizer structure of the encoding isometry. It would be 
interesting to move beyond stabilizer encodings, or use 
the formalism of approximate access structures |33] . i.e. 
a subset is authorized if it can recover the secret with 
some bounded error. For the latter problem one should 
definitely use more general encoding isometries, since the 
stabilizer ones induce quantum channels with integer ca- 
pacities, and this is the subject of future work. 

Finally it is interesting to note that the structure of the 
intermediate information group Q (T) is similar to that of 
non- Abelian groups used in entanglement-assisted quan- 
tum error correcting codes [31], and investigating the 
relations between the former and the latter may prove 
fruitful. 
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